AUTHENTICATED_USER is not reliable! [Was: [Zope] become user (su inside Zope) - pretend to be another user]

[Brad Clements]

On 24 Oct 2003 at 10:35, Stefan H. Holek wrote:

> Why is everybody so obsessed with AUTHENTICATED_USER? This variable is not
> suitable for anything deserving the name "security". It is NOT SAFE to
> assume that it will contain anything useful.

Thanks for bringing this up.

I've changed my code. I had thought that AUTHENTICATED_USER was "a special 
attribute of REQUEST".



-- 
Brad Clements,                bkc at murkworks.com   (315)268-1000
http://www.murkworks.com                          (315)268-9812 Fax
http://www.wecanstopspam.org/                   AOL-IM: BKClements